bru Posted August 28, 2010 ID:306118 Share Posted August 28, 2010 Hello,I am wondering about the following situation. I ran Norman Malware Cleaner, a tool I have used occasionally since cleaning an infection about a month ago. It found the following infected file:C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Infected with W32/DLoader.DAJD)Scanning: postscanNumber of files found: 307169Number of archives unpacked: 7816Number of files scanned: 307163Number of files not scanned: 6Number of files skipped due to exclude list: 0Number of infected files found: 1Number of infected files repaired/deleted: 0Number of infections removed: 0Searching popcaploader.dll and W32/DLoader.DAJD shows it's related to a game my wife has played, Bejeweled 2. Some AV software identifies it as malware, others don't. virustotal.com showed 40% of tested AV programs found it, including Norman.I found this thread here, where the poster's log under files infected showed MBAM found the exact same infected file and quarantined and deleted it successfully. http://forums.malwarebytes.org/lofiversion...php?t38702.html My full MBAM scan (see below) did not find it. So my questions are: Why would MBAM find it for another user and not for me? Has popcaploader.dll and/or W32/DLoader.DAJD been deemed not a threat? Is it a threat that I should remove? If so how? MBAM doesn't find it, so back to Norman?ThanksMalwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4494Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.187028/28/2010 11:18:51 AMmbam-log-2010-08-28 (11-18-51).txtScan type: Full scan (C:\|)Objects scanned: 270981Time elapsed: 1 hour(s), 53 minute(s), 52 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
Staff screen317 Posted August 28, 2010 Staff ID:306198 Share Posted August 28, 2010 Hi and welcome to Malwarebytes.PopCap isn't "malware." It's used by games as you pointed out, but it has a history of questionable activity (adware and such). If you aren't experiencing any issues then it's likely that you don't have any adware.That topic was back in February and it's likely that the detection has been pulled due to it cleaning up its behavior. I cannot say for sure since I'm not a MBAM developer, but that's my best estimation. Essentially, you would be getting popups if it still had adware functionality.Does this answer your question? Link to post Share on other sites More sharing options...
bru Posted August 29, 2010 Author ID:306277 Share Posted August 29, 2010 Hi and welcome to Malwarebytes.PopCap isn't "malware." It's used by games as you pointed out, but it has a history of questionable activity (adware and such). If you aren't experiencing any issues then it's likely that you don't have any adware.That topic was back in February and it's likely that the detection has been pulled due to it cleaning up its behavior. I cannot say for sure since I'm not a MBAM developer, but that's my best estimation. Essentially, you would be getting popups if it still had adware functionality.Does this answer your question?It sure does. No popups that I have seen, I'll have my wife keep an eye out too. There definitely is a bit of conflicting info about popcaploader but I trust MBAM and if they aren't flagging it that's good enough for me. Thank you Link to post Share on other sites More sharing options...
Staff screen317 Posted August 29, 2010 Staff ID:306284 Share Posted August 29, 2010 I'll leave this thread open for a few days in case you have any other questions. Link to post Share on other sites More sharing options...
bru Posted August 29, 2010 Author ID:306581 Share Posted August 29, 2010 I am confused as to how W32/DLoader.DAJD fits in to this? Is it part of PopCap or something separate? PopCap itself may be somewhat harmless but is the W32/DLoader.DAJD something to be concerned about? There are many different "infections" associated with popcaploader.dll listed on sites such as virustotal (e.g. W32/Downldr2.RVE, Trj/Downloader.MDW). When do you know if it's something really bad. Link to post Share on other sites More sharing options...
Staff screen317 Posted August 29, 2010 Staff ID:306810 Share Posted August 29, 2010 When do you know if it's something really bad.If you are unsure please feel free to ask us here in the forum."Downloaded.DAJD" is just their naming convention. Most antivirus venders name their targets differently so it appears as though all of them are detecting a "different" infection, when in actuality it's just how they name it. If it were truly a "downloader" it would have downloaded other files to your computer and you would most likely be experiencing symptoms of infection (popups, etc.)... Link to post Share on other sites More sharing options...
Staff screen317 Posted September 28, 2010 Staff ID:319560 Share Posted September 28, 2010 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts